{"id":"CVE-2026-95985","kind":"vulnerability","aliases":["CVE-2026-95985"],"related":[],"title":"Kiro IDE: file write tool lets crafted repos run commands and poison agent","description":"CVE-2026-95985 - Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces\n\n### CVE-2026-95985 - Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces\n\nBulletin ID: 2026-117-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/24/2026 10:00 AM PDT\n\nDescription:\n\nKiro is an agentic IDE that users install on their desktop. We identified CVE-2026-95985. The file write tool in Kiro IDE before version 1.0.242 might allow remote unauthenticated actors to execute arbitrary commands and to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to auto-loaded global configuration paths.\n\nImpacted versions: < 1.0.242\n\nResolution:\n\nThis issue has been addressed in Kiro IDE version 1.0.242. We recommend upgrading to the latest version. Users who ran the agent in an untrusted workspace on an earlier version should also review the global Kiro configuration directory (~/.kiro on macOS and Linux, %USERPROFILE%\\.kiro on Windows) for entries they did not create.\n\nWorkarounds:\n\nNone.\n\nReferences:\n\n- CVE-2026-95985\n\nAcknowledgement:\n\nWe would like to thank Dinh Ngoc Dung for collaborating on this issue through the coordinated disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"Kiro IDE, an agentic coding editor, has a file write tool that, when the agent runs in a crafted untrusted repository, can modify auto-loaded global configuration paths on the user's machine. An attacker who supplies such a repository can get arbitrary command execution and inject instructions into the agent's context.","severity":"high","cvss":8.8,"epss":0.00135,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["agentic-ide","ai-tooling","aws","desktop","developers","ide","kiro","lab-disclosure"],"not_affected_if":["kiro-1.0.242-or-later","no-kiro-installed"],"how_to_check":"- Check the installed Kiro IDE version and compare it against `1.0.242`.\n- Review the global Kiro configuration directory `~/.kiro` on macOS and Linux, or `%USERPROFILE%\\.kiro` on Windows, for entries the user did not create.","fix":"- Upgrade Kiro IDE to `1.0.242` or later.\n- For anyone who ran the agent in an untrusted workspace on an earlier version, review `~/.kiro` (or `%USERPROFILE%\\.kiro`) for unknown entries and remove them.","status":"open","published_at":"2026-09-24T00:00:00+00:00","first_seen_at":"2026-10-24T20:05:36+00:00","triaged_at":"2026-10-25T05:29:26+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T05:29:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Kiro IDE to `1.0.242` or later.\n- For anyone who ran the agent in an untrusted workspace on an earlier version, review `~/.kiro` (or `%USERPROFILE%\\.kiro`) for unknown entries and remove them.","reach":"internet","title":"Kiro IDE: file write tool lets crafted repos run commands and poison agent","impact":"high","summary":"Kiro IDE, an agentic coding editor, has a file write tool that, when the agent runs in a crafted untrusted repository, can modify auto-loaded global configuration paths on the user's machine. An attacker who supplies such a repository can get arbitrary command execution and inject instructions into the agent's context.","category":"ai-tooling","nicknames":[],"who_cares":["kiro","ide","agentic-ide","desktop","developers"],"confidence":0.8,"needs_auth":"no","worst_case":"Arbitrary command execution on developer machine and injected agent instructions","analyst_note":"","how_to_check":"- Check the installed Kiro IDE version and compare it against `1.0.242`.\n- Review the global Kiro configuration directory `~/.kiro` on macOS and Linux, or `%USERPROFILE%\\.kiro` on Windows, for entries the user did not create.","needs_analyst":false,"not_affected_if":["kiro-1.0.242-or-later","no-kiro-installed"],"who_is_affected":"Developers who run Kiro IDE before 1.0.242 and open or run the agent in repositories they do not trust can be exposed, since the agent's writes can reach global configuration. Teams that only use Kiro on trusted workspaces are at lower risk, but the advisory recommends upgrading regardless. Teams not using Kiro can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000713,"input_tokens":3875,"output_tokens":650,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-117':123C '-2026':15A,18A,89C,105C,154C,274C '-95985':16A,19A,90C,106C,155C,275C '/.kiro':255C '00':136C '09/24/2026':134C '1.0.242':165C,215C,226C '10':135C '2026':122C 'acknowledg':276C 'actor':170C 'address':221C 'agent':13A,21B,37B,48B,85B,94C,110C,143C,182C,190C,204C,238C 'agentic-id':20B 'ai':24B 'ai-tool':23B 'allow':93C,109C,167C 'also':248C 'arbitrari':77B,173C 'attack':69B 'attent':131C 'auto':58B,208C 'auto-load':57B,207C 'aw':26B,124C,126C 'aws-security@amazon.com':297C 'bulletin':120C 'caus':203C 'code':38B 'collabor':286C 'command':10A,78B,174C 'concern':303C 'configur':61B,98C,114C,211C,253C 'content':127C 'context':87B,184C 'coordin':292C 'craft':7A,52B,178C,193C 'creat':269C 'cve':14A,17A,88C,104C,153C,273C 'date':133C 'descript':139C 'desktop':27B,150C 'develop':28B 'dinh':282C 'directori':254C 'disclosur':33B,293C 'dung':284C 'earlier':245C 'editor':39B 'email':296C 'entri':265C 'execut':79B,172C 'file':3A,42B,157C 'get':76B 'global':60B,97C,113C,210C,251C 'id':121C 'ide':2A,22B,29B,35B,92C,108C,144C,162C,224C 'identifi':152C 'impact':213C 'import':129C 'inject':81B,177C 'instal':147C 'instruct':82B,179C 'issu':218C,289C 'kiro':1A,30B,34B,91C,107C,140C,161C,223C,252C,261C 'lab':32B 'lab-disclosur':31B 'latest':232C 'let':6A 'like':279C 'linux':259C 'load':59B,209C 'machin':67B 'maco':257C 'messag':201C 'might':166C 'modif':205C 'modifi':56B 'ngoc':283C 'none':271C 'path':62B,212C 'pdt':138C 'pleas':295C 'poison':12A 'process':294C 'public':132C 'question':301C 'ran':236C 'recommend':228C 'refer':272C 'remot':168C 'repo':8A 'repositori':54B,74B,194C 'requir':130C 'resolut':216C 'review':249C 'run':9A,49B,188C 'scope':125C 'secur':300C 'send':199C 'suppli':71B 'thank':281C 'tool':5A,25B,44B,159C 'type':128C 'unauthent':169C 'untrust':53B,102C,118C,197C,241C 'upgrad':229C 'user':65B,146C,187C,234C 'userprofil':260C 'version':164C,214C,225C,233C,246C 'window':263C 'work':100C,116C 'workaround':270C 'workspac':103C,119C,198C,242C 'would':278C 'write':4A,43B,95C,111C,158C","nicknames":[],"mitigations":[],"who_affected":"Developers who run Kiro IDE before 1.0.242 and open or run the agent in repositories they do not trust can be exposed, since the agent's writes can reach global configuration. Teams that only use Kiro on trusted workspaces are at lower risk, but the advisory recommends upgrading regardless. Teams not using Kiro can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-24T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-117-aws/#CVE-2026-95985","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-117-aws/","severity":null,"published_at":"2026-09-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T20:05:36+00:00","fetched_at":"2026-10-24T20:05:36+00:00","note":"AWS: CVE-2026-95985 - Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces"},{"source":"nvd","external_id":"CVE-2026-95985","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95985","severity":null,"published_at":"2026-09-24T18:19:08+00:00","modified_at":"2026-09-24T19:36:39+00:00","first_seen_at":"2026-10-24T20:15:27+00:00","fetched_at":"2026-10-24T20:15:27+00:00","note":null},{"source":"epss","external_id":"CVE-2026-95985","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95985","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2977,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-117-aws/","title":"AWS: CVE-2026-95985 - Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces","kind":"advisory","source":"lab","text":"CVE-2026-95985 - Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces\n\n### CVE-2026-95985 - Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces\n\nBulletin ID: 2026-117-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/24/2026 10:00 AM PDT\n\nDescription:\n\nKiro is an agentic IDE that users install on their desktop. We identified CVE-2026-95985. The file write tool in Kiro IDE before version 1.0.242 might allow remote unauthenticated actors to execute arbitrary commands and to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to auto-loaded global configuration paths.\n\nImpacted versions: < 1.0.242\n\nResolution:\n\nThis issue has been addressed in Kiro IDE version 1.0.242. We recommend upgrading to the latest version. Users who ran the agent in an untrusted workspace on an earlier version should also review the global Kiro configuration directory (~/.kiro on macOS and Linux, %USERPROFILE%\\.kiro on Windows) for entries they did not create.\n\nWorkarounds:\n\nNone.\n\nReferences:\n\n- CVE-2026-95985\n\nAcknowledgement:\n\nWe would like to thank Dinh Ngoc Dung for collaborating on this issue through the coordinated disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-09-24T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}